368924 - turn on safe-browsing

Status: RESOLVED DUPLICATE of bug 778611

(Thunderbird :: Preferences, defect)

Description

[Justin Dolske [:Dolske]]

I started with a new profile, and added an IMAP server account. I then when through the settings to customize things, and noticed that the "Use a downloaded list of email scams" option was *not* checked by default. I believe Firefox enables the downloaded anti-phishing list by default, so it seems like TB's pref should also default to enabled.

Comment 1

[Magnus Melin [:mkmelin]]

Actually... the feature won't be enabled at all - see bug 368635. (And the UI is no longer displayed.)

Comment 2

[Daniel Veditz [:dveditz]]

The bug said we wouldn't get it in Thunderbird 2. Can agreements be worked out for Thunderbird 3?

Comment 3

[David Ascher (:davida)]

I sure hope so.  I wonder who knows what the story is...

Comment 4

[David Ascher (:davida)]

Not sure if we can get this in b2, but...

Comment 5

[David :Bienvenu]

my understanding is that this requires legal approval from the anti-phishing provider. If that process hasn't started, then I don't see that we can get this for b2, so moving to b3

Comment 6

[Bryan Clark (DevTools PM) [:clarkbw]]

this still seems to be on the b2 list, actually moving to b3

Comment 8

[David Ascher (:davida)]

adjusting status to make sure that i keep on top of it.

Comment 9

[David Ascher (:davida)]

rafael is going to take this on.

Comment 10

[David Ascher (:davida)]

We wouldn't block on this, I don't think.

Comment 11

[Rafael Ebron (:rebron)]

I chatted with the Google folks on this.

We can go ahead and a) use googpub-phish-shavar as the string and b) enable this pref by default.

The string in Firefox is goog-phish-shavar and they're still checking to see if we can use it also.  

over to bienvenu.

Comment 12

[David :Bienvenu]

Here's the code that I think needs to change:

http://mxr.mozilla.org/comm-central/source/mail/base/content/phishingDetector.js#76

Comment 13

[David :Bienvenu]

this should be trivial to try...

Comment 14

[David :Bienvenu]

Rafael, you were going to get me a bad url so I could tell if the code was working...

Comment 15

[David :Bienvenu]

Attachment: possible fix

in theory this should fix it, though without knowing what a bad url might be, it's hard to test...

Comment 16

[David :Bienvenu]

Rafael, can we get access to a malware list as well?

Comment 17

[Rafael Ebron (:rebron)]

I'll get the list from MozQA.

Comment 18

[Rafael Ebron (:rebron)]

David,

Here's what I got from QA:
http://www.phishtank.com/ (live examples)
https://litmus.mozilla.org/show_test.cgi?id=6988

Comment 19

[David :Bienvenu]

Attachment: turn on safe-browsing pref

We may need to turn this pref on as well...I haven't been able to verify that this is working yet, though.

Comment 20

[David Ascher (:davida)]

FYI, I applied the patch, and loaded a message with a link to http://www.mozilla.com/firefox/its-a-trap.html in it. Nothing happened.

Comment 21

[David Ascher (:davida)]

Attachment: about:config differences

1) I sent myself an email containing the url  http://www.irs.gov.nuko7ur.eu/fraud_application/directory/statement.php?email=x&tid=rpowell-00000174073547US   (which I got from phishtank.com), looked at it in the Sent folder, and got no warning.  (going to that URL in firefox does trigger the red screen of scare)

2) Looking at the 'safebrowsing' prefs in both firefox and thunderbird, there seem to be a lot of differences.

Feels like more work is needed.

Comment 22

[David :Bienvenu]

Have you run with the second patch? I haven't checked anything in yet, and I haven't been able to verify that this works.

Comment 23

[David :Bienvenu]

(In reply to comment #22)
> Have you run with the second patch? I haven't checked anything in yet, and I
> haven't been able to verify that this works.

ah, sorry, I read my bug mail from newest to oldest and didn't see your comment. If we want this to potentially block, we should mark it blocking, otherwise it tends to fall off my radar :-(

Comment 24

[David Ascher (:davida)]

Adding to blocker list, but changing title to indicate that what we should do is to figure out if it's easy, not that we'll block until this is fixed.  It seems like a good security win if we can leverage the existing infrastructure, but if it's too hard, we can target it to the next release.

Comment 25

[Simon Paquet [:sipaq]]

Don't we have to fork the UI and the strings that are currently in mozilla/browser for this? This will be hard given that we're three days away from the string freeze.

Comment 26

[Simon Paquet [:sipaq]]

Are the patches in this bug really all that is needed here? If yes, then we don't need to worry about the upcoming string freeze for TB3 tomorrow, but if not, then we need to get traction on this bug ASAP.

Comment 27

[David :Bienvenu]

The code in TB 2.0 basically made a copy of the FF 2 phishing stuff, and left the db stuff turned off. The current FF anti-phishing stuff is somewhat different, and to get this to work, I think I'd need to re-copy the current FF code. I made a quick stab at it, and it didn't work. So this is looking a bit iffy. 

Re the string freeze, the current design is to show the same warning for message with black-listed urls as we do for manually detected bad urls, i.e., no string changes needed.

Comment 28

[David :Bienvenu]

taking off blocking - I'd love to do this, but I'm not going to block on it.

Comment 29

[Dan Mosedale (:dmosedale, :dmose)]

We really really want this.  That said, if it were the last bug standing, I don't believe we'd hold 3.1 for much time to get it, so I'm marking blocking- and wanted+.  clarkbw, I suspect this does want to live on our soon-to-be-created medium-term-feature-focus page.  Do you agree?  If so, can you add it to your list?  Also, I'm still not totally sure how the feature-focus wiki pages and our wanted flags should interact.  Thoughts there appreciated.

Comment 30

[Mark Banner (:standard8)]

Too late for 3.1

Comment 31

[Ludovic Hirlimann [:Usul]]

What needs to be done to go forward with this ?

Comment 32

[David :Bienvenu]

Someone needs to figure out how to adapt the new FF anti-phishing code to Thunderbird.

Comment 33

[Nomis101]

The patch uses googpub-phish-shavar (Camino too), but Firefox and Fennec are using goog-phish-shavar:
http://mxr.mozilla.org/mozilla-central/source/browser/components/safebrowsing/content/application.js#112
What are the differences?

Comment 34

[Gian-Carlo Pascutto [:gcp]]

Prolly only Google knows that, but comment 11 and various other bugs related to this (i.e. for Iceweasel) seem to suggest that Google uses googpub for data-users that aren't as extensively checked for correct behavior as current Firefox is.

Comment 35

[Wayne Mery (:wsmwk)]

Is this important in any strategic sense?

Comment 36

[Kent James (:rkent)]

(In reply to Wayne Mery (:wsmwk) from comment #35)
> Is this important in any strategic sense?

I don't see any strategic reason why this should be given particular consideration. Yes it would be nice to have.

Comment 37

[Magnus Melin [:mkmelin]]

Obsoleted by bug 778611.